CVE-2025-10035

What it actually does

CVE-2025-10035 is a critical deserialization flaw in the License Servlet of Fortra GoAnywhere MFT. If an attacker can provide a forged license response with a valid-looking signature, the servlet may deserialize attacker-controlled data. Successful exploitation can result in arbitrary object deserialization and possible command injection on the GoAnywhere MFT server, allowing remote code execution in the context of the application process. Because GoAnywhere MFT commonly handles sensitive file transfers, compromise can expose credentials, transfer configurations, stored files, and connected systems.

Why it matters to the business

This vulnerability creates a high-likelihood path to full compromise of a managed file transfer platform that may contain sensitive business, customer, partner, or regulated data. It is listed in CISA KEV, has active in-the-wild exploitation, is associated with ransomware activity, and has a very high EPSS score, meaning organizations should treat exposed GoAnywhere MFT instances as urgent-risk systems. Potential consequences include data theft, interruption of file-transfer operations, ransomware deployment, breach notification obligations, partner disruption, and regulatory exposure. CISA’s KEV remediation deadline is 2025-10-20 for applicable organizations.

How an attack unfolds

An attacker identifies an internet-accessible Fortra GoAnywhere MFT instance and targets the License Servlet. The attacker crafts or obtains a forged license response whose signature is accepted by the application, embedding a serialized malicious object in the request. When the servlet processes the license response, it deserializes the attacker-controlled object. If a usable gadget chain or vulnerable code path is present, deserialization triggers command execution or command injection on the server. The attacker then typically establishes persistence, enumerates the GoAnywhere application, harvests credentials or transfer definitions, stages or exfiltrates files, and may deploy ransomware or hands-on-keyboard tooling. Reported exploitation activity includes Storm-1175 and Medusa ransomware-related campaigns, so post-exploitation review should assume both data-theft and ransomware objectives.

How to fix it

Upgrade Fortra GoAnywhere MFT to a vendor-fixed release as soon as possible. No exact fixed versions were provided in the input, so security teams should consult Fortra’s advisory for CVE-2025-10035 and apply the latest supported release or hotfix that explicitly addresses this issue. If immediate patching is not possible, restrict access to GoAnywhere administrative and license-related endpoints to trusted management networks or VPNs, block direct internet access, enforce WAF rules for suspicious license servlet requests, and monitor for exploit attempts. Rotate credentials stored in or used by GoAnywhere MFT after patching if exploitation is suspected. Because this vulnerability is in CISA KEV and associated with ransomware campaigns, treat mitigation-only approaches as temporary.

How to confirm the fix worked

Confirm the installed GoAnywhere MFT version is at or above the vendor-fixed version listed in Fortra’s advisory. Verify that the License Servlet and administrative interfaces are not reachable from untrusted networks unless explicitly required and protected. Review reverse proxy, WAF, and web server logs for requests to license-related GoAnywhere paths before and after remediation. Confirm application logs no longer show deserialization, license parsing, or command execution errors associated with crafted license responses. Run an authenticated configuration review to ensure no unexpected users, transfer jobs, triggers, scripts, scheduled tasks, or credential changes were introduced. If the system was internet-facing before remediation, perform compromise assessment rather than relying only on version validation.

Typical attack path

1. Discover internet-facing Fortra GoAnywhere MFT administrative or application endpoints.
2. Send crafted requests to the GoAnywhere License Servlet using a forged license response signature.
3. Trigger unsafe deserialization of attacker-controlled object data.
4. Execute operating-system commands or payloads in the context of the GoAnywhere MFT service account.
5. Establish persistence through web shells, scheduled tasks, new users, modified application configuration, or external remote access tooling.
6. Enumerate transfer jobs, credentials, partner connections, stored files, and accessible network shares.
7. Exfiltrate sensitive files or credentials.
8. Optionally deploy ransomware or destructive tooling after data theft.

How to detect it

Investigate whether the GoAnywhere MFT server received suspicious requests to license-related servlet endpoints, especially from unfamiliar external IPs, around or after publication on 2025-09-18. Review reverse proxy, load balancer, WAF, web access, and GoAnywhere application logs for requests containing license-response parameters, serialized object patterns, unusually large POST bodies, repeated license validation failures, or server errors. In application logs, look for Java deserialization exceptions, license parsing errors, signature validation anomalies, stack traces, and unexpected invocation of scripts or commands. On the host, review EDR, process creation, command-line, scheduled task, cron, service, and file-write telemetry for child processes spawned by the GoAnywhere Java process, such as shells, PowerShell, curl, wget, certutil, archive utilities, or scripting runtimes. Review GoAnywhere audit logs for new administrative users, changed permissions, modified transfer jobs, newly added triggers, unexpected SSH keys, changed credentials, or unusual file access. Network telemetry should be checked for abnormal outbound connections, large file transfers, connections to newly observed destinations, and staging activity. Because Storm-1175 and Medusa ransomware-related activity have been associated with this vulnerability, also hunt for ransomware precursor behavior such as credential dumping, lateral movement, backup discovery, mass file enumeration, and archive creation.

• /goanywhere/lic/accept
• /goanywhere/lic/accept.xhtml
• License Servlet
• license response
• java.io.ObjectInputStream
• java.io.InvalidClassException
• java.io.StreamCorruptedException
• java.io.WriteAbortedException
• org.apache.commons.collections
• Runtime.getRuntime().exec
• ProcessBuilder
• cmd.exe /c
• powershell.exe
• pwsh.exe
• /bin/sh -c
• /bin/bash -c
• curl
• wget
• certutil.exe
• bitsadmin.exe
• rclone
• 7z.exe
• rar.exe
• tar -czf

What your security team should do

• Immediately inventory all Fortra GoAnywhere MFT instances, including externally hosted, partner-facing, and disaster-recovery systems.
• Patch or upgrade affected GoAnywhere MFT servers to a vendor-fixed release; prioritize internet-exposed systems first.
• If patching cannot be completed immediately, remove public exposure and restrict access to trusted administrative networks.
• Hunt for prior exploitation across web, WAF, reverse proxy, GoAnywhere application, operating system, EDR, and network logs.
• Treat any successful exploitation as a potential data-theft and ransomware precursor; preserve evidence and begin incident response if indicators are found.
• Rotate GoAnywhere administrative credentials, service account passwords, API keys, SSH keys, and credentials used in transfer jobs if compromise cannot be ruled out.
• Review for newly created accounts, modified transfer jobs, unexpected scripts, persistence mechanisms, and unusual outbound connections.
• Add SIEM detections for requests to GoAnywhere license endpoints, deserialization exceptions, child processes spawned by the GoAnywhere Java process, and suspicious archive or staging activity.
• Use CISA KEV status, ransomware association, very high EPSS, and active exploitation by Storm-1175/Medusa-related campaigns to justify emergency change handling.